NHS data sold to US drug giants

And it’s simple for firms to trace patients, say experts

MILLIONS of NHS patients risk being identified through medical data which is sold to US pharmaceutical giants, experts claim.

Patient data from Britain’s GP surgeries and hospitals is routinely sold to international drug companies for millions.

The information is ‘ anonymised’ first with names taken out, but senior NHS officials have warned that patients can still be identified.

They claim there is evidence that organisations which have bought the data have already traced back to individual patients whose medical histories were of most interest.

Professor Eerke Boiten, director of the Cyber Technology Institute at de Montfort University in Leicester, said: ‘It is not anonymous. If it is rich medical data about individuals then the richer that data is, the easier it is for people who are experts to reconstruct it and reidentify individuals.’

Privacy campaigner Phil Booth, of the group medConfidential, believes the public is being betrayed.

‘Removing or obscuring a few obvious identifiers, like someone’s name or NHS number from the data, doesn’t make their medical history anonymous,’ he told the Observer yesterday.

‘Indeed, the unique combination of medical events that makes individuals’ health data so ripe for exploitation is precisely what makes it so identifiable. Your medical record is like a fingerprint of your whole life. Patients must know how their data is used, and by who.

‘Alleging their data is anonymous when it isn’t, then selling it to drugs and tech companies – or, through intermediaries, to heaven knows who – is a gross betrayal of trust.

‘People who are rightly concerned about such guile and lack of respect have every right to opt out if they want their own and their family’s medical information kept confidential and for their own care.’

Access to NHS patient records is increasingly sought by researchers and drug firms because they contain a unique data set of 55million patients from birth to death.

In other countries the data is scattered around several different institutions, making it harder to collate in large volumes.

As part of any post-Brexit trade agreement, the US wants unrestricted access to patient data, which last year was given an estimated value of almost £10billion by professional services firm EY.

Licences to buy data are issued by the Clinical Practice Research datalink, which is part of the Medicines and Healthcare Products Regulatory Agency (MHRA).

A MHRA spokesman insisted that the information sold was ‘anonymised in accordance with the Information Commissioner’s Office anonymisation code of practice’.

If NHS patients do not wish their data to be used for this kind of research, they currently have to actively opt out of the system by asking their GP.

‘People have every right to opt out’